MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b62dc83e91db6431a0937c7b3835dc38cc475c7f9d7c2ecf877d73c2ec9320be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b62dc83e91db6431a0937c7b3835dc38cc475c7f9d7c2ecf877d73c2ec9320be
SHA3-384 hash:	bec2b3e9407251bf0a9b56deccfc2c3dfcd2699ca8d25c61d44307fca4d59ad96d88157feecc25181e9d8a9a5186cbc1
SHA1 hash:	23ffaff69a3cd4412b263587df7f10227baea845
MD5 hash:	e8c30e962070c325004f80b3c4fc3546
humanhash:	king-texas-oscar-oxygen
File name:	loader (3).sh
Download:	download sample
Signature	SHubStealer Alert Create hunting rule
File size:	745 bytes
First seen:	2026-05-29 06:23:25 UTC
Last seen:	2026-05-29 06:23:30 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:SCny997dG3BCFr+Bnx8jiFHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB73O9y:7QxdGxCFnm1EDlgNjTidGXhGIBFVR98c
TLSH	T1B80199EF343234721F5385E65C1391534D76C33F5BD05DA878E56B3409AE020633022E
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	JAMESWT_WT
Tags:	sh SHub-Stealer SHubStealer

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

52

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.MacOS.Stealer-HG.67365437.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6a1930e9099ef368af0af589/reports/75908803-b14a-4e69-bba9-d967d0a21eca/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-05-29T01:00:00Z UTC

Last seen:

2026-05-30T23:06:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.dv not-a-virus:HEUR:Downloader.OSX.Agent.ad

Link:

https://opentip.kaspersky.com/b62dc83e91db6431a0937c7b3835dc38cc475c7f9d7c2ecf877d73c2ec9320be/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/7fde2a80-58d1-4929-b899-90857b7a2d5e

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

12%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/b62dc83e91db6431a0937c7b3835dc38cc475c7f9d7c2ecf877d73c2ec9320be

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b62dc83e91db6431a0937c7b3835dc38cc475c7f9d7c2ecf877d73c2ec9320be/

Neiki Downloader.OSX.Agent

Verdict:

Malicious

Threat:

Downloader.OSX.Agent

Link:

https://tip.neiki.dev/file/b62dc83e91db6431a0937c7b3835dc38cc475c7f9d7c2ecf877d73c2ec9320be

ReversingLabs TitaniumCloud MacOS.Trojan.SuspMalScript

Threat name:

MacOS.Trojan.SuspMalScript

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-28 23:22:06 UTC

File Type:

Text (Shell)

AV detection:

13 of 38 (34.21%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wyw4qpur3nsddietpr5tqno4hdgeoxd7tv6c5t4hpvz4f3etec7a._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

antivm discovery linux

Link:

https://tria.ge/reports/260529-g5shnsdz2q/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Checks CPU configuration

Looks up external IP address via web service

VMRay SHubStealer

Malware family:

SHubStealer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b62dc83e91db/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/b62dc83e91db6431a0937c7b3835dc38cc475c7f9d7c2ecf877d73c2ec9320be